coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document scope alignment and warden-sign readiness

Browse source
This commit is contained in:
tegwick 2026-06-30 00:52:05 +02:00
parent d8aadaffe3
commit ae685f3a0a
10 changed files with 736 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/ops-warden-routing-contract.md
View file

@ -1,10 +1,11 @@
# ops-warden → secrets-engine Routing Contract
ops-warden issues **SSH certificates only**. Every other credential need (API
keys, provider tokens, DB passwords, npm publish tokens, and OpenBao API token
lanes) routes to **secrets-engine**, which is OpenBao-backed. ops-warden must
never request, hold, cache, or vend a raw secret value. A route result is a
**pointer**, not a key.
ops-warden issues **SSH certificates only**. Every other credential or scoped
capability need (API keys, provider tokens, DB passwords, npm publish tokens,
and OpenBao capability lanes) routes to **secrets-engine**. secrets-engine
returns non-secret pointers and safe next commands while OpenBao remains the
custody, policy, lease, and audit backend. ops-warden must never request, hold,
cache, or vend a raw secret value. A route result is a **pointer**, not a key.
## What ops-warden calls
@ -49,6 +50,9 @@ secrets-engine route <catalog-id> --json
- **Actionable when not ready.** If a lane is unapproved, unapplied, or
unprovisioned, `next_command` + `missing` tell the caller exactly what to do.
- **Idempotent / read-only.** `route` performs no mutation.
- **Custody stays in OpenBao.** secrets-engine orchestrates approved issuance,
delivery, handoff, verification, and revocation paths; it does not make
ops-warden a secret store or token broker.
## whynot-design retry flow